CVE-2021-35060

OpenWay WAY4's ACS enrollment endpoint answers unauthenticated requests differently depending on whether a given payment card number is already stored in the system. An attacker who can hit /way4acs/enroll can therefore probe card numbers and learn, from the response difference, which ones the system knows about — an oracle for validating cardholder data without any login. It discloses no code path and grants no access; the impact is confidentiality, but of exactly the data a payment system exists to protect.

The severity sits at medium because it's an enumeration oracle, not a dump — an attacker learns "yes/no this card is enrolled" one query at a time, not the full record. But in the payments context that's genuinely useful: it lets an actor validate stolen or generated card numbers against a live issuer/acquirer system, and the unauthenticated, remote nature means anyone who can reach the endpoint can run it at scale. This is the kind of side channel that feeds card-fraud pipelines.

Our emphasis is exposure containment and abuse detection. An ACS enrollment endpoint has no business being broadly reachable, so the first task is confirming that any WAY4 below 1.2.278-2693 has that path restricted to the intended card-network paths, not the open internet. Because the exploit is just repeated legitimate-looking requests, we'd also treat volumetric probing of the enroll endpoint as a detection signal and rate-limit it, since the fix removes the response difference but reachability control blunts the oracle in the meantime.